Email notification settings API returns the stored SMTP password #5987

Symptoms

GET /api/notifications/email on the ServiceControl error instance returns the stored SMTP password in the authentication_password field. Every caller that can read the email notification settings can read the password.

Who's affected

Users of ServiceControl 4.17.0 to 6.21.1 who configured email notifications with an SMTP account and password. Turning email notifications off does not remove a stored password.

Who can read the settings:

• Authentication disabled (the default): every caller that can reach the API.
• Authentication and role-based authorization enabled: every role, including reader.

Root cause

The API returned the stored email notification settings object, including the password. ServicePulse read the password into the settings form and sent it back on save. The save replaced the stored password with the value from the request.

Confirmed workarounds

• Change the password of the SMTP account, and limit what the account can send. See securing the SMTP account.
• If email notifications are not needed, remove the SMTP account and password from the email notification settings.

Backported to

• 6.21.2